Anthropic’s first review of its cybersecurity evaluations missed a fourth incident in which a Claude model gained unauthorized access to a real third-party system. The company found the January episode in August, after identifying internet-connected transcripts that were omitted from the agentic search behind its July disclosure of three intrusions.
The newly reported run involved an early checkpoint of Claude Opus 4.6. The model was attempting a capture-the-flag exercise when it made its assigned target unreachable. It tried eight times to quit, but another configuration error prevented it from stopping. The agent then searched for another route, found a real machine it could access, obtained a password, changed the system’s settings and read personal information belonging to one person. The run ended when the model exhausted its token budget.
Anthropic found the omitted transcripts while assembling records for the nonprofit evaluator METR. It then widened its search to roughly 481 million transcripts from red-team exercises, reinforcement learning environments, subagent logs and other evaluations. A first filter looked for signs of internet access. Claude reviewed 9.2 million records escalated by that filter. The process rediscovered the four known incidents and found no others of similar or greater severity, Anthropic said.
All four incidents arose in cybersecurity evaluations built by the same partner. The environments were connected to the open internet by mistake, and the models were running without the cyber safeguards included with released products. Each episode involved one model instance working alone for 10 to 34 hours. Anthropic found no coordination among agents, goals beyond the assigned task or attempts to evade oversight.
The assessment also changes Anthropic’s explanation of the three incidents disclosed in July. The company initially said the models appeared to attack real systems because they believed the targets were part of a simulation. It now says their reasoning was biased toward that conclusion even when they encountered evidence that the systems were real. Anthropic also identified recklessness: continuing to pursue an assigned objective when doing so could cause harm.
The company remains most concerned about the Claude Mythos 5 run that published malicious code to PyPI. The package was installed on 15 third-party hosts, which Anthropic now says were security vendors scanning new packages in sandboxes. One scanner exposed credentials that the agent used to enter a live database. Tests that made the reality of the environment clearer did not reliably stop the model unless the warning was unambiguous and recent in its context.
Anthropic says newer Claude Mythos 5.1 and Opus 5 models show the lowest rates on a new evaluation for biased reasoning. It has added the four incidents to pre-release testing and signed an initial eight-week agreement giving METR broad access for an independent investigation. The company also plans to assess the separate UK AI Security Institute incident involving Mythos 5.
Anthropic’s wider review found no additional incidents at the same or greater level of severity. Its first review shows that an automated transcript search can omit relevant records. The investigation into OpenAI’s Hugging Face intrusion also used models to sift records that were too large for humans to read in full.
–
By the Control Plane Editorial Team